The document discusses container images, highlighting that they can be built without Dockerfiles using tools like Jib and Ko for Java and Go applications, respectively. It emphasizes best practices for image creation, the benefits of automation and simplicity, and potential downsides including security complacency and knowledge concentration. Resources and links for further learning are also provided.

1. NO DOCKERFILES!
LOOK MA’…
Photo by Chanaka from Pexels
https://www.pexels.com/photo/cargo-container-lot-906494/
@ERICSMALLING

2. LOOK MA’, NO DOCKERFILES!
CONTAINER IMAGES 101
▸ Images are just a collection of tarballs
▸ Base
fi
lesystem and environment info a
container will start from
▸ Can contain metadata: i.e. annotations/labels
▸ Commonly build from Docker
fi
le syntax
▸ Stored in repositories in registries (DockerHub,
GCR, ECR, Quay, Harbor, etc)
▸ Standardized format: OCI
Photo by Frans van Heerden
https://www.pexels.com/photo/assorted-color-trailer-boxes-2881632/

3. LOOK MA’, NO DOCKERFILES!
IMAGE LAYERS - FROM DOCKERFILE
FROM maven:3-jdk-8-slim as build
RUN mkdir /app/src
WORKDIR /app/src
COPY pom.xml pom.xml
COPY src src
RUN --mount=target=$HOME/.m2,type=cache mvn install
FROM tomcat:8.5.21
RUN mkdir /tmp/extracted_files
COPY web.xml /usr/local/tomcat/conf/web.xml
COPY --from=build /app/src/target/myapp /usr/local/tomcat/webapps/myapp
LABEL org.opencontainers.image.source=https://repo.mycorp.com/team-volton/redlion
tomcat:8.5.21
/tmp/
extracted_files
…/web.xml
…/myapp
LABEL
org.opencontainers.i
mage/source

4. LOOK MA’, NO DOCKERFILES!
IMAGE BEST PRACTICES
▸ Minimize Footprint
▸ Layer Housekeeping
▸ Build strategies
▸ Organizational standards
Photo by David McBee
https://www.pexels.com/photo/tilt-shift-lens-photography-of-red-crane-miniature-392031/

5. Photo by Yan Krukov from Pexels
https://www.pexels.com/photo/photo-of-woman-showing-frustrations-on-her-face-4458420/
I JUST WANT TO
BUILD MY APP!

6. LOOK MA’, NO DOCKERFILES!
JIB AND KO
https://github.com/GoogleContainerTools/jib
▸ Build OCI images for Java applications without
a Docker daemon or Docker
fi
le.
▸ 100% Java implementation
▸ Plugins for Maven and Gradle
▸ Allows for organizational standards via parent
POM inheritance.
▸ Opinionated defaults (can be overridden)

7. LOOK MA’, NO DOCKERFILES!
JIB AND KO
https://github.com/google/ko
▸ Build OCI images for Go applications without a
Docker daemon or Docker
fi
le.
▸ ko wraps the go build tool
▸ Effectively slides in place of “go build”
▸ Allows for organizational standards via a .ko.yaml
fi
le
▸ Opinionated defaults (can be overridden
▸ Kubernetes integration
▸ SBOM creation & SigStore integration

8. LOOK MA’, NO DOCKERFILES!
MAVEN + DOCKER
MVN PACKAGE .JAR
DOCKER BUILD IMAGE .JAR
DOCKER PUSH
REGISTRY
IMAGE .
IMAGE
IMAGE
IMAGE
DOCKER / K8S RUN
(IMPLICIT PULL) IMAGE .
CONTAINER
DOCKERFILE

9. LOOK MA’, NO DOCKERFILES!
MAVEN + DOCKER

10. LOOK MA’, NO DOCKERFILES!
MAVEN + DOCKER

11. LOOK MA’, NO DOCKERFILES!
MAVEN + DOCKER

12. LOOK MA’, NO DOCKERFILES!
MAVEN + DOCKER

13. LOOK MA’, NO DOCKERFILES!
JIB
MVN PACKAGE
REGISTRY
IMAGE .
IMAGE
IMAGE
IMAGE
DOCKER / K8S RUN
(IMPLICIT PULL) IMAGE .
CONTAINER

14. LOOK MA’, NO DOCKERFILES!
JIB

15. LOOK MA’, NO DOCKERFILES!
JIB

16. LOOK MA’, NO DOCKERFILES!
JIB

17. LOOK MA’, NO DOCKERFILES!
GO + DOCKER
GO BUILD BIN
DOCKER BUILD IMAGE BIN
DOCKER PUSH
REGISTRY
IMAGE .
IMAGE
IMAGE
IMAGE
DOCKER / K8S RUN
(IMPLICIT PULL) IMAGE .
CONTAINER
DOCKERFILE

18. LOOK MA’, NO DOCKERFILES!
GO + DOCKER

19. LOOK MA’, NO DOCKERFILES!
GO + DOCKER

20. LOOK MA’, NO DOCKERFILES!
GO + DOCKER

21. LOOK MA’, NO DOCKERFILES!
KO
KO BUILD
REGISTRY
IMAGE .
IMAGE
IMAGE
IMAGE
DOCKER / K8S RUN
(IMPLICIT PULL) IMAGE .
CONTAINER

22. LOOK MA’, NO DOCKERFILES!
KO

23. LOOK MA’, NO DOCKERFILES!
KO

24. LOOK MA’, NO DOCKERFILES!
KO
KO BUILD
REGISTRY
IMAGE .
IMAGE
IMAGE
IMAGE
DOCKER / K8S RUN
(IMPLICIT PULL)
CONTAINER
IMAGE .
REKOR
SBOM

25. LOOK MA’, NO DOCKERFILES!
KO + K8S
KO BUILD
REGISTRY
IMAGE .
IMAGE
IMAGE
IMAGE
REKOR
SBOM
KUBECTL
.YAML

26. LOOK MA’, NO DOCKERFILES!
KO + K8S
KO APPLY
REGISTRY
IMAGE .
IMAGE
IMAGE
IMAGE
REKOR
SBOM
.YAML

27. LOOK MA’, NO DOCKERFILES!
KO + K8S

28. LOOK MA’, NO DOCKERFILES!
KO + K8S

29. PROS & CONS

30. LOOK MA’, NO DOCKERFILES!
PROS
▸ Simplicity
▸ Hides complexity
▸ Developers can focus on their core strengths
▸ Streamlines processes
Photo by Erik Geiger from Pexels
https://www.pexels.com/photo/close-up-on-engine-start-button-in-car-7085726/

31. LOOK MA’, NO DOCKERFILES!
PROS
▸ Guidance & Governance
▸ Opinionated defaults reviewed by the open
source community but overridable as
needed
▸ Org / Team speci
fi
cs can be managed using
existing tools (i.e. Parent POM)
▸ Fosters a culture of automation over manual
tasks / tribal knowledge
Photo by Nextvoyage
https://www.pexels.com/photo/brown-asphalt-road-beside-lake-730662/

32. LOOK MA’, NO DOCKERFILES!
PROS
▸ Security
▸ Minimal images limit attack blast radius
▸ Automation produces deterministic results
and is auditable
▸ Standardized processes limit human error
Photo by Scott Webb
https://www.pexels.com/photo/two-gray-bullet-security-cameras-430208/

33. LOOK MA’, NO DOCKERFILES!
CONS
▸ Black Box / Magic
▸ Abstracting away complexity can focus
knowledge on a few, specialized people
▸ Lack of ability to troubleshoot container
technologies because it’s not understood
but the wider team
▸ Burnout of the few that do understand it
▸ Outages if nobody understands it
Image by @docker (@laurelcomics )
https://twitter.com/Docker/status/1239256807366934530

34. LOOK MA’, NO DOCKERFILES!
CONS
▸ Security complacency
▸ With image creation “magically” happening,
image scanning can get forgotten
▸ Vulnerabilities found in un-updated images,
packages, libraries, etc can be missed
▸ Continuous scans via build scripts or
other tooling can help. (automate,
automate, automate)
Image by @docker (@laurelcomics )
https://twitter.com/Docker/status/1239256807366934530

35. LOOK MA’, NO DOCKERFILES!
CONS
▸ Docker
fi
les are not that dif
fi
cult
▸ Syntax is pretty simple
▸ Best practices are well documented
▸ Linter’s and scanners exist to catch issues
Image by @docker (@laurelcomics )

36. LOOK MA’, NO DOCKERFILES!
RESOURCES
▸ jib: https://github.com/GoogleContainerTools/jib
▸ My blog: https://snyk.io/blog/building-java-container-images-using-jib/
▸ ko: https://github.com/google/ko
▸ Stanley Nguyen video: https://youtu.be/TpfKCE9uyCA
▸ Docke
fi
le reference docs: https://docs.docker.com/engine/reference/builder/
▸ My blog on image annotations/labels:
https://snyk.io/blog/how-and-when-to-use-docker-labels-oci-container-annotations/
▸ Examples used in these slides: https://github.com/ericsmalling/alt-image-builders
https://dockr.ly/TortoiseAcres
@ERICSMALLING